Re: SNMP concerns

Jim,

Good points, all. The DPI interface is what IBM exposes on the iSeries for
SNMP functions (get, set, trap, etc.). The iSeries SNMP support is SNMPv2,
but as I understand it the SNMPv1 functions are supported in SNMPv2. I'm
glad IBM is taking a look at this. I'm not aware of that many IBM shops
using the DPI interfaces for SNMP, but a fair number start SNMP to get the
basic set of services.

Patrick
----- Original Message -----
From: "Jim Franz" <franz400@triad.rr.com>
To: <midrange-l@midrange.com>
Sent: Friday, February 15, 2002 7:57 PM
Subject: Re: SNMP concerns


> It was interesting to see on the Cert site this morning that "IBM" is
listed
> as
> "Not Vulnerable" on Jan 4-2002 (inside it says "AIX" only)
> later in the list is "IBM z-Series" with status "unknown" on Jan 7-2002.
> No iSeries listed. p-Series is vulnerable because of Microsoft.
>
> 2nd point - I would not be comfortable with only the firewall protecting
> your
> network. A decent trojan planted anywhere in your network (from all your
> users that continue to open attachments!) could easily mount an attack
> from inside.
>
> 3rd point - on the iSeries we lived with a very outdated (and with CERT
> warning) DNS server while AIX enjoyed the latest (and more secure)
> version. I feel NO COMFORT that AIX snmp is ok and the iSeries
> is traditionally silent.
>
> <please correct me if wrong>
> 1. SNMP is not started automatically unless STRTCPSVR *ALL is run,
> or if the Change SNMP Attributes (CHGSNMPA) has autostart=*yes.
> To not autostart - run CHGSNMPA AUTOSTART(*NO)
>
> 2. Just scanned the Simple Network Management Protocol (SNMP) Support
> Version 4 book SC41-5412-00 (1997) on website. Not knowing much it seems
> like
> part of OS400 support SNMPv1 and part is SNMPv2. But this statement
> bothers me, page 33 says"The DPI API for OS/400 is the 2.0 level of the
> protocol.
> This is designed to be highly compatible with SNMPv2 even if the SNMP
Agent
> is SNMPv1. (again, this is the only book I could find and is from 1997)
>
> 3. The Tips and Tools for Securing Your iSeries has specific snmp tips.
(see
> Info Center)
> secure port 161 (well known for snmp)
> set snmp server autostart to *no
> <clip>
> SNMP relies on a community name for access. Conceptually, the community
name
> is similar to a password. The community name is not encrypted. Therefore,
it
> is vulnerable to sniffing. Use the Add Community for SNMP (ADDCOMSNMP)
> command to set the manager internet address (INTNETADR) parameter to one
or
> more specific IP addresses instead of *ANY. You can also set the OBJACC
> parameter of the ADDCOMSNMP or CHGCOMSNMP commands to *NONE to prevent the
> managers in a community from accessing any MIB objects. This is intended
to
> just be done temporarily to deny access to managers in a community without
> removing the community. </clip>
>
> Does anyone know a source in IBM to clear this up?
> jim franz
>
>
>
> ----- Original Message -----
> From: "Patrick Townsend" <patownsend@patownsend.com>
> To: <midrange-l@midrange.com>
> Sent: Friday, February 15, 2002 7:41 PM
> Subject: Re: SNMP concerns
>
>
> > Fritz,
> >
> > Interesting. The CERT notice calls out two primary areas of
vulnerability.
> > One in SNMP managers and one in SNMP agents. The AS/400 doesn't have a
> > native manager, so that part doesn't apply to the AS/400. But it
certainly
> > has an SNMP agent and sub-agent support.
> >
> > The denial of service is a well known type of attack. Good firewall and
> > router implementations will help prevent damage from outside sources.
> Since
> > SNMP is almost never run over the Internet, these ports shouldn't be
open
> > anyway. I suspect the risk from an internal SNMP denial of service
attack
> is
> > pretty small. But, as the alert points out, there are steps you can take
> to
> > minimize this type of attack.
> >
> > The vulnerabilities in SNMPv1 are another matter. I couldn't find any
> place
> > where IBM addresses the AS/400 (ahem, I mean iSeries). IBM clearly
states
> > that AIX is not vulnerable. But no mention of iSeris. I hope they will
> > comment on this for the iSeries platform.
> >
> > Patrick
> > ----- Original Message -----
> > From: "Fritz Hayes" <fhayes@spiritone.com>
> > To: <midrange-l@midrange.com>
> > Sent: Friday, February 15, 2002 2:33 PM
> > Subject: RE: SNMP concerns
> >
> >
> > > The CERT Vulnerability Note VU#854306 indicated that the SNMP
processing
> > > of
> > > GetRequest, SetRequest, GetNextRequest, GetResponse, and Trap has
> > > vulnerablities.
> > > These weaknesses include "denial-of-service conditions, format string
> > > vulnerabilities, and buffer overflows."  In addition, "some
> > > vulnerabilities do not require the request message to use the correct
> > > SNMP community string".
> > >
> > > Which means, the SNMP service can be used to compromise OS/400.
> > >
> > > IBM responded with:  "Based upon the results of running the test
suites
> > > we have determined that our version of SNMP shipped with AIX is NOT
> > > vulnerable."
> > >
> > > If Dr. Frank's hypothesis is right, IBM SNMP implementation is
probably
> > > the same for AIX as it is for OS/400.  Which makes my worries go
away -
> > > - Right??????
> > >
> > > I know that SNMP is used regularly on internal networks.  Some people
> > > are even using it to drive their AS/400 printers.  A couple of
customers
> > > want to remotely manage their equipment, using VPN connections on the
> > > Internet.  SNMP could be the right tool, but only if internal hackers
> > > can be kept out!  With the CERT notification,  and in general, is a
> > > properly configured AS/400 susceptible to SNMP attacks?
> > >
> > > Best Regards
> > >
> > > Fritz Hayes
> > > Atwater Associates
> > > <snip>
> > >
> > > |
> > > |We run SNMP on the AS/400 and provide SNMP options in our
> > > |products. What concerns do you have?
> > > |
> > > <snip>
> > > |>
> > > |> So, who out there is running and using SNMP on their AS/400,
iSeries
> > > |> box?
> > > |>
> > > |> A second question, who is using the SNMP protocol over the
Internet?
>
>
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>